Security readout for executives and security teams
Plain-English summary
This issue affects a specific Comtrend AR-5310 firmware build and can let someone with local access escape intended command restrictions. It is serious for environments where the device shell is reachable by users or operators. The sources do not show active exploitation or a vendor patch.
Executive priority
Treat as a high-priority router/device exposure if this exact model and firmware are in use. Prioritize inventory and access restriction first, because public exploit information exists and no fix is named in the provided sources.
Technical view
Comtrend AR-5310 firmware GE31-412SSG-C01_R10.A2pG039u.d24k has a restricted shell escape. The advisory states allowed commands can be abused through command substitution arguments to execute unrestricted commands. CVSS 4.0 is 8.6 high, with local attack vector and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to Comtrend AR-5310 devices running the named firmware build where an attacker can reach the local restricted shell. The provided sources do not establish internet-wide remote exposure or affected status for other firmware versions.
Exploitation context
A public ExploitDB entry and VulnCheck advisory exist, so technical details are public. CISA KEV status is false in the provided data, and no cited source confirms active exploitation in the wild.
Researcher notes
The record is narrowly scoped to one firmware string and default status says other versions are unaffected unless proven otherwise. Patch status is not provided. Avoid broad claims about other Comtrend products, remote exploitability, or active exploitation without additional evidence.
Mitigation direction
- Identify any Comtrend AR-5310 devices and confirm the exact firmware build.
- Check Comtrend or device-provider guidance for firmware updates or replacement options.
- Restrict management and shell access to trusted administrators only.
- Segment affected devices from sensitive networks where practical.
- Monitor for unusual administrative sessions or unexpected command activity.
Validation and detection
- Inventory device model and firmware version from approved asset records or management interfaces.
- Confirm whether restricted shell access is enabled or reachable by local users.
- Review logs for unexpected use of allowed diagnostic commands.
- Check exposure paths through console, LAN management, remote support, or delegated operator accounts.
- Track vendor, ISP, or maintainer advisories for remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25483 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47149CVE reference · exploit
- VulnCheck Advisory: Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k Restricted Shell EscapeCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.